Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

10.7. Converting Masters and Clones

Only one single active CA generating CRLs can exist within the same topology. Similarly, only one OCSP receiving CRLs can exist within the same topology. As such, there can be any number of clones, but there can only be a single configured master for CA and OCSP.
For KRAs and TKSs, there is no configuration difference between masters and clones, but CAs and OCSPs do have some configuration differences. This means that when a master is taken offline — because of a failure or for maintenance or to change the function of the subsystem in the PKI — then the existing master must be reconfigured to be a clone, and one of the clones promoted to be the master.

10.7.1. Converting CA Clones and Masters

  1. Stop the master CA if it is still running.
  2. Open the existing master CA configuration directory:
    Copy to Clipboard Toggle word wrap 
    # cd /var/lib/pki/instance_name/ca/conf
  3. Edit the CS.cfg file for the master, and change the CRL and maintenance thread settings so that it is set as a clone:
    • Disable control of the database maintenance thread:
      Copy to Clipboard Toggle word wrap 
      ca.certStatusUpdateInterval=0
    • Disable monitoring database replication changes:
      Copy to Clipboard Toggle word wrap 
      ca.listenToCloneModifications=false
    • Disable maintenance of the CRL cache:
      Copy to Clipboard Toggle word wrap 
      ca.crl.IssuingPointId.enableCRLCache=false
    • Disable CRL generation:
      Copy to Clipboard Toggle word wrap 
      ca.crl.IssuingPointId.enableCRLUpdates=false
    • Set the CA to redirect CRL requests to the new master:
      Copy to Clipboard Toggle word wrap 
      master.ca.agent.host=new_master_hostname
master.ca.agent.port=new_master_port
  4. Stop the cloned CA server.
    Copy to Clipboard Toggle word wrap 
    # systemctl stop pki-tomcatd@instance_name.service
  5. Open the cloned CA's configuration directory.
    Copy to Clipboard Toggle word wrap 
    # cd /etc/instance_name
  6. Edit the CS.cfg file to configure the clone as the new master.
    1. Delete each line which begins with the ca.crl. prefix.
    2. Copy each line beginning with the ca.crl. prefix from the former master CA CS.cfg file into the cloned CA's CS.cfg file.
    3. Enable control of the database maintenance thread; the default value for a master CA is 600.
      Copy to Clipboard Toggle word wrap 
      ca.certStatusUpdateInterval=600
    4. Enable monitoring database replication:
      Copy to Clipboard Toggle word wrap 
      ca.listenToCloneModifications=true
    5. Enable maintenance of the CRL cache:
      Copy to Clipboard Toggle word wrap 
      ca.crl.IssuingPointId.enableCRLCache=true
    6. Enable CRL generation:
      Copy to Clipboard Toggle word wrap 
      ca.crl.IssuingPointId.enableCRLUpdates=true
    7. Disable the redirect settings for CRL generation requests:
      Copy to Clipboard Toggle word wrap 
      master.ca.agent.host=hostname
master.ca.agent.port=port number
  7. Start the new master CA server.
    Copy to Clipboard Toggle word wrap 
    # systemctl start pki-tomcatd@instance_name.service

10.7.2. Converting OCSP Clones

  1. Stop the OCSP master, if it is still running.
  2. Open the existing master OCSP configuration directory.
    Copy to Clipboard Toggle word wrap 
    # cd /etc/instance_name
  3. Edit the CS.cfg, and reset the OCSP.Responder.store.defStore.refreshInSec parameter to 21600:
    Copy to Clipboard Toggle word wrap 
    OCSP.Responder.store.defStore.refreshInSec=21600
  4. Stop the online cloned OCSP server.
    Copy to Clipboard Toggle word wrap 
    # systemctl stop pki-tomcatd@instance_name.service
  5. Open the cloned OCSP responder's configuration directory.
    Copy to Clipboard Toggle word wrap 
    # cd /etc/instance_name
  6. Open the CS.cfg file, and delete the OCSP.Responder.store.defStore.refreshInSec parameter or change its value to any non-zero number:
    Copy to Clipboard Toggle word wrap 
    OCSP.Responder.store.defStore.refreshInSec=15000
  7. Start the new master OCSP responder server.
    Copy to Clipboard Toggle word wrap 
    # systemctl start pki-tomcatd@instance_name.service
Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat, Inc.